d672b9fa14678dc087591c07527a511a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d672b9fa14678dc087591c07527a511a_JaffaCakes118
Size

606KB
MD5

d672b9fa14678dc087591c07527a511a
SHA1

28e3b303dbbbc88d3d67e8c19de04ca5f87a9633
SHA256

915dbeac7f2f838aa06ca01078d726b35491fee90227f7f84ef73a61762a674b
SHA512

d8397085ee8c7fdb13f2bca5d3711575269947e40912d2e5ccc62c7e934933c8e8054fe024dae18dbbe8aad8c1e7f1cd9787bc7a71b9ed106f4a17cd5279c276
SSDEEP

12288:z6w6INyX8Py92+ykjT75D1KgwhlN9+cku4Hz:z6wtekSzl1knNStHz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d672b9fa14678dc087591c07527a511a_JaffaCakes118

Files

d672b9fa14678dc087591c07527a511a_JaffaCakes118
.exe windows:5 windows x86 arch:x86

a6354b60a9f1527f2095e4fa6ac9b371

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileA
CreateFileW
GetCommandLineW
GetModuleHandleW
GetModuleHandleA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
GetCurrentProcess
VirtualAllocEx

user32

LoadIconW
LoadCursorA

advapi32

RegQueryValueExA
RegOpenKeyA

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 506B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 567KB - Virtual size: 567KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ggt2
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ggt0
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ